Splunk Search

splunk search

foysal0124
Explorer

 

I have an event value like this  2021-02-15 18:07:33,936, where the last value after comma(936) means the response time in ms. i tried to extract that value and want to average response time but it did not work.

how i can extract the value after comma from that field. i tried something like this 

avg(mvindex(split(TimeStamp,","),-1)) as AverageResponse

TimeStamp=2021-02-15 18:07:33,936

 

Best Regards

Foysal

Labels (1)
0 Karma

foysal0124
Explorer

awesome, it worked

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @foysal0124,

you can extract the values between commas using a regex and then calculate average using the stats command, something like this:

Your_search
| rex ",(?<response_time>\d+),"
| stats avg(response_time) AS average

if in your logs there's the possibility to have also other numbers between commas, you have to use a just a little more complex regex like this:

Your_search
| rex "^\d+-\d+-\d+\s+\d+:\d+:\d+,(?<response_time>\d+),"
| stats avg(response_time) AS average

that you can test at https://regex101.com/r/q4VyFQ/1

Ciao.

Giuseppe

foysal0124
Explorer

awesome test tool, thanks

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @foysal0124,

You use rex command like below;

| rex field=TimeStamp "\,(?<AverageResponse>\d+)"
If this reply helps you an upvote and "Accept as Solution" is appreciated.

foysal0124
Explorer

awesome, it worked, thanks for ur help

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...